How Scratch Itch Software handles your information — which is, deliberately, almost none of it.
Effective 4 August 2026. This policy covers the Scratch Itch Software applications (AcrossKM, CmdTab, fnMute, MoonPhase, iCloudWatch, Hostbar, IceMelt, Olympus, SPX Tracker, Read2Me and the Foundry Virtual Tabletop modules) and the website at scratchitchsoftware.com.
The rest of this page is the honest detail: the small amount of data that unavoidably exists, why it exists, how long it lasts, and how to make it go away.
Scratch Itch Software is a trading name of Paradigm Consulting Co LLC, a small independent software business in the United States. Paradigm Consulting Co LLC is the data controller for the information described here. For any question or request about privacy, write to [email protected]. Every message is read by a person, not a ticketing system.
Apart from the two described in the next section, which connect to other machines as their whole purpose, the apps run on your own computer and make network connections in only two circumstances.
Once a day, and whenever you choose “Check for Updates…”, an app requests a small text file from this website that lists the current version. If yours is older, the app asks whether you would like the update; if you decline, nothing further happens. The request carries no account, licence key, device identifier or usage information. As with any request to any website, our web server does see your IP address and the standard User‑Agent string your system sends, which identifies the application, its version and your operating system version. That information lands in the ordinary server logs described below and is used for nothing else.
Paid applications confirm that a licence key is valid. This transmits the licence key and an identifier for the installation it is activated on, so that a key can be limited to a reasonable number of machines and released when you deactivate one. It does not transmit your name, your files or anything about how you use the app. Licence keys are issued and verified through our payment provider (see Purchases below).
That is the complete list. You do not have to take our word for it: point a network monitor such as Little Snitch at any of our apps and watch what they do.
Two apps talk to the network because that is their entire function. Neither sends anything to us.
The Foundry Virtual Tabletop modules run inside your own Foundry server and make no outbound connections of their own.
There is no analytics service on this site. No Google Analytics, no tag manager, no pixels, no cookies, and no third‑party fonts, scripts or images — every asset is served from this domain, so visiting a page tells nobody but us that you were here.
The web server keeps standard access logs, as essentially every web server does. Each entry records the IP address, the time, the page or file requested, the response status and the User‑Agent string. These logs exist so that the site can be kept working and secure, and they rotate away automatically after a few weeks.
Before they rotate, a nightly job reduces them to a download tally: for each date and file, how many downloads there were and how many distinct addresses they came from. It stores the count of distinct addresses, never the addresses themselves, so the retained figures cannot be traced back to any individual. Nothing else is extracted, and the tally is used only to know whether an app is worth continuing to build.
Paid licences are sold through Lemon Squeezy, which acts as the merchant of record. This means Lemon Squeezy — not us — handles the checkout, takes the payment, calculates and remits sales tax and VAT, and issues your invoice and licence key.
Your payment details are entered on their systems and are never seen by, transmitted to or stored by us. We hold no card numbers. From a completed order we receive only what is needed to support you and to keep correct business records: your name, your email address, your country, and the details of what you bought. Lemon Squeezy separately collects the information it requires to process the payment and satisfy tax and anti‑fraud obligations, which includes billing address and IP address; their handling of that data is governed by Lemon Squeezy's privacy policy.
We use your email address to send your licence key, to reply to you, and to tell you about anything genuinely important regarding a product you bought, such as a security fix. There is no marketing mailing list, and your address is not shared with anyone else.
Applications bought through the Apple App Store are purchased from Apple under Apple's own terms; Apple does not give us your payment details, and we receive only aggregate sales reporting that does not identify individual customers.
If you write for support or any other reason, we keep the correspondence so that the conversation makes sense over time — and no longer than it stays useful. It is not added to any mailing list or used for anything other than answering you.
Keeping the list short is a deliberate design goal. In full, it is:
Nobody else receives your information. It is never sold, rented, bartered, or disclosed to advertisers, data brokers or analytics companies. We would disclose information only if the law genuinely compelled it.
Wherever you live, you may ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it, or ask for it in a portable form. Write to [email protected] and we will respond within 30 days. Exercising any of these rights costs nothing and will never result in worse service or a higher price.
In practice, for most people the honest answer to “what do you hold about me?” is nothing at all, because you never gave us anything. If you have bought a licence, we can delete your record on request, subject only to the invoice data that tax law requires us to keep for a period.
If you are in the UK, the EU or the EEA, our legal bases are: performance of a contract for order and licence data; legitimate interests for keeping the service running, secure and free of abuse, and for counting downloads; and legal obligation for tax and accounting records. You also have the right to complain to your local data protection authority.
If you are in California, we do not sell or share personal information as those terms are defined by the CCPA, and we do not use it for cross‑context behavioural advertising. We have never done so.
We are based in the United States, and Lemon Squeezy, Apple and GitHub operate internationally, so information relating to a purchase may be processed outside your country.
These are desktop utilities for general audiences, not products directed at children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has sent us information, write to us and it will be deleted.
The website is served over HTTPS. Application downloads are code‑signed, and Mac builds are notarized by Apple, so your computer can verify that what you install came from us and has not been altered. Updates are verified against that signature before they are applied. The strongest protection here is structural: data we never collect cannot be breached, leaked or subpoenaed.
If this policy changes, the effective date at the top will change with it. If a change ever meaningfully affects how your information is handled, we will say so plainly on this page rather than quietly editing it.
Anything here unclear, or something you would like deleted? Write to [email protected].